| LivePlayer removal process |
|
| Author:admin CopyFrom:web Hits: UpdateTime:2008-11-15 10:54:53 |
Begin of the article LivePlayer removal process
1.DownloadGoogle recommend safer browser Web browser, For more safe , Stay Secure on the Web and stay far away virus,Download URL http://www.oral8.net/firefox/firefox.htm
2. Temporarily Disable System Restore (Windows Me/XP).
3. Update the virus definitions. Reboot computer in SafeMode
4. Run a full system scan and clean/delete all LivePlayer infected files and Delete/Modify any values added to the registry.
Navigate to the subkey and delete the valuesas following:
Behavior
The potentially unwanted application can be manually downloaded and installed.
The program reportedly installs other risks.
When manually executed, it displays an installation wizard which includes an End User License Agreement.
Installation
When the program is executed, it creates the following folders:
- %UserProfile%\Local Settings\Application Data\live-player\
- C:\Documents and Settings\All Users\Start Menu\Programs\Live-Player\
- %ProgramFiles%\Live-Player\
- %ProgramFiles%\Live-Player\data\
- %ProgramFiles%\Live-Player\skins\
It then drops the following files:
- %UserProfile%\Local Settings\Application Data\[RANDOM FILE NAME].dat
- %UserProfile%\Local Settings\Application Data\[RANDOM FILE NAME].exe (detected as Trojan.Skintrim)
- %UserProfile%\Local Settings\Application Data\[RANDOM FILE NAME]_nav.dat
- %UserProfile%\Local Settings\Application Data\[RANDOM FILE NAME]_navps.dat
- %UserProfile%\Local Settings\Application Data\live-player\flv.swf
- %UserProfile%\Local Settings\Application Data\live-player\liveplayer.s3db
- %UserProfile%\Local Settings\Temp\db.dat
- %UserProfile%\Local Settings\Temp\liveplayer_exe.dat
- %UserProfile%\Local Settings\Temp\liveplayer_skin.dat
- %UserProfile%\Local Settings\Temp\skin_dll.dat
- %UserProfile%\Local Settings\Temp\sqlite_dll.dat
- C:\Documents and Settings\All Users\Desktop\Live-Player.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Live-Player\Live-Player.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Live-Player\Privacy Policy.url
- C:\Documents and Settings\All Users\Start Menu\Programs\Live-Player\Terms and Conditions.url
- C:\Documents and Settings\All Users\Start Menu\Programs\Live-Player\Uninstall.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Live-Player\Website.url
- %ProgramFiles%\Live-Player\data\translation_file_live-player.xml
- %ProgramFiles%\Live-Player\live-player.exe
- %ProgramFiles%\Live-Player\SkinCrafterDll.dll
- %ProgramFiles%\Live-Player\skins\live-player.skf
- %ProgramFiles%\Live-Player\sqlite3.dll
- %ProgramFiles%\Live-Player\uninst.exe
- %Wind8r%\Temp\msksetup.log
It creates the following registry entry, so that it runs every time Windows starts:
HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM NAME]" = "c:\documents and settings\administrator\local settings\application data\[RANDOM FILE NAME].exe"
It creates the following registry subkeys:
- HKEY_CURRENT_USERS\Software\LanConfig
- HKEY_CURRENT_USERS\Software\OOO
- HKEY_CURRENT_USERS\Software\fcn
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[RANDOM NAME]
- HKEY_LOCAL_MACHINE\SOFTWARE\OOO
Similar Security Risks:
WebMediaPlayer
5. Exit registry editor .
6.delete the IE temp files or you may download ATF temp files cleaner to run a full cleaning.and restart the computer.
8. Now you may remove LivePlayer successfully.
|
| howtoremoveInputer:admin Editor:admin |
| End Of The Article how to remove LivePlayer |
|
Back 个howtoremove:Trojan.Knowedel
Next 个howtoremove: W32.Winemmem!inf |
